@bongos/core 1.19.773 → 1.19.775

package/scripts/gds/seam-wiring-guard.js

@@ -0,0 +1,273 @@
+// scripts/gds/seam-wiring-guard.js — Check 33: a declared contributes.<seam> that
+// nothing consumes (task 1003819; successor to abandoned task 1002464).
+//
+// THE GAP THIS CLOSES. A module declares what it contributes in module.json.
+// src/module-seams.js `verifyPortsSatisfied` checks the OPPOSITE direction — every
+// `consumes` port has exactly one provider among the enabled modules — and
+// src/module-loader/manifest-schema.js `validateManifest` checks the SHAPE of
+// `contributes` (a closed key set, so a typo'd KEY errors). Neither asks whether a
+// declared entry is actually WIRED. So a module can declare `contributes.pollers:
+// ["ghost"]` with no modules/<key>/pollers/ghost.js and boot stays silent: the
+// loader's startModulePollers treats a missing poller file as declarative-only and
+// skips it, hallWidgetScripts skips a uiSection with no hall-widget.js, and
+// moduleWebSurfaces skips a surface whose dir was never shipped. Every one of those
+// skips is correct behaviour for a REAL declarative-only entry, and indistinguishable
+// from a typo or a rename that left the manifest behind.
+//
+// WHAT "CONSUMED" MEANS. Each seam has one consumer in the tree, and each consumer
+// looks for one artifact at a fixed path. SEAM_CONSUMERS below records that pairing —
+// seam → the artifact its consumer resolves — so this guard asks the same question
+// the consumer asks rather than inventing a second convention that could drift from
+// it. A seam with NO consumer anywhere carries `consumer: null`, and every
+// declaration of it is reported: that is the strongest form of the defect.
+//
+// WHY A CI GATE AND NOT A BOOT REFUSAL (ADR 0289). `verifyEnabledPorts` throws at
+// boot because an unprovided port otherwise becomes a runtime throw on a request
+// path, in a process that reported healthy — refusing early is strictly safer. For
+// every seam BUT `routes`, an unconsumed contribution is not that shape: the consumer
+// skips it gracefully, nothing crashes later, and the instance runs correctly minus
+// one feature. Adding a production start-up failure for a manifest-hygiene defect
+// would trade a real outage risk for a cosmetic one.
+//
+// `routes` is the exception and it argues the SAME way: mountModuleRoutes `require`s
+// the factory with no try/catch, so a missing route file already takes the boot down
+// today. There the guard is not a new gate at all — it moves an existing crash from
+// production start-up to the build, which is strictly earlier and strictly cheaper.
+// So CI covers both cases: the seams that fail silently get a voice, and the one that
+// fails loudly gets to fail before it reaches a server.
+//
+// Exported for scripts/gds/fitness.js (checkSeamWiring) and for the unit suite, which
+// drives scanSeamWiring() over synthetic manifests with an injected `exists` so every
+// case is hermetic — the scanScopeMapSource / scanDeterministicBody precedent, where
+// the pure scanner is the tested surface.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+// The SAME enumerator + labeller validateManifest uses for the exemption cross-check,
+// imported rather than re-declared: two copies would drift, and the drift would land
+// on whether an exemption is honoured (task 1003819).
+const { declaredEntries, entryLabel } = require('../../src/module-loader/manifest-schema.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// Is `child` inside `parent`? Both are repo-relative-or-absolute; normalised before
+// comparing so a '..' segment cannot pass by spelling.
+function within(parent, child) {
+  const a = path.resolve(REPO_ROOT, parent);
+  const b = path.resolve(REPO_ROOT, child);
+  const r = path.relative(a, b);
+  return r !== '' && !r.startsWith('..') && !path.isAbsolute(r);
+}
+
+// A repo-relative, forward-slashed path for an error message.
+function rel(p) {
+  if (!p) return '(no artifact path)';
+  const r = path.relative(REPO_ROOT, path.isAbsolute(p) ? p : path.join(REPO_ROOT, p));
+  return r.split(path.sep).join('/');
+}
+
+// seam → how its consumer resolves a declared entry to an on-disk artifact.
+//   consumer   the function that actually reads it, named so a reader can go check
+//   kind       'file' | 'dir' | 'registry' — what must exist
+//   artifact   (moduleDir, entry) → path, or null when the seam is per-MODULE rather
+//              than per-entry (uiSections ships ONE widget however many it names)
+//   alternates optional extra paths that also count as wired
+const SEAM_CONSUMERS = {
+  routes: {
+    consumer: 'src/module-loader/loader.js mountModuleRoutes',
+    kind: 'file',
+    artifact: (dir, entry) => path.join(dir, 'routes', `${entry}.js`),
+  },
+  pollers: {
+    consumer: 'src/module-loader/loader.js startModulePollers',
+    kind: 'file',
+    artifact: (dir, entry) => path.join(dir, 'pollers', `${entry}.js`),
+  },
+  rooms: {
+    // Allowed by the manifest schema since the doorway, but nothing in core reads
+    // contributes.rooms — the realtime seam was never wired to the loader. No module
+    // declares it today; if one ever does, this guard says so rather than letting the
+    // declaration read as though it did something.
+    consumer: null,
+    kind: 'file',
+    artifact: (dir, entry) => path.join(dir, 'rooms', `${entry}.js`),
+  },
+  uiSections: {
+    // Per-MODULE, not per-entry: hallWidgetScripts looks for one hall-widget.js
+    // however many sections the module names.
+    consumer: 'src/module-loader/loader.js hallWidgetScripts',
+    kind: 'file',
+    artifact: (dir) => path.join(dir, 'public', 'hall-widget.js'),
+  },
+  skills: {
+    // moduleSkillSources resolves a declared name against the module's OWN tree or
+    // its vendor/ subdir. A name that exists only in the core .claude/skills/ is
+    // skipped by it (`if (!src) continue`), so it is unconsumed BY THE MANIFEST —
+    // a legitimate declarative-only case, and what ui-design's exemption records.
+    //
+    // The artifact is the SKILL.md, not the directory: moduleSkillSources tests
+    // `fs.existsSync(path.join(p, 'SKILL.md'))`, so a skills/<name>/ dir without one
+    // is NOT a skill to it. Probing the bare directory would call such an entry wired
+    // while the real consumer skipped it — this guard's own defect, on the seam with
+    // the most declared entries.
+    consumer: 'scripts/gds/claude-materialize.js moduleSkillSources',
+    kind: 'file',
+    artifact: (dir, entry) => path.join(dir, 'skills', entry, 'SKILL.md'),
+    alternates: (dir, entry) => [path.join(dir, 'skills', 'vendor', entry, 'SKILL.md')],
+  },
+  disciplines: {
+    consumer: 'scripts/gds/discipline-modes.json (read by src/modules.js + claim.js)',
+    kind: 'registry',
+    artifact: () => null,
+  },
+  webSurfaces: {
+    consumer: 'src/module-loader/loader.js moduleWebSurfaces',
+    kind: 'dir',
+    // `entry` is the surface OBJECT here, not a string.
+    artifact: (dir, entry) => (entry && typeof entry.dir === 'string' ? path.join(dir, entry.dir) : null),
+  },
+  migrations: {
+    consumer: 'scripts/migrate.sh (the module-migration runner)',
+    kind: 'dir',
+    artifact: (dir) => path.join(dir, 'migrations'),
+  },
+};
+
+// Default existence probe — `kind` decides file-vs-directory. A relative path is
+// resolved against the repo root so a manifest's `dir` may be either.
+function fsExists(p, kind) {
+  try {
+    const st = fs.statSync(path.isAbsolute(p) ? p : path.join(REPO_ROOT, p));
+    return kind === 'dir' ? st.isDirectory() : st.isFile();
+  } catch {
+    return false;
+  }
+}
+
+// THE SCANNER. Pure over its inputs (the only I/O is the injected `exists`), so the
+// unit suite drives every case with synthetic manifests and no tmp dirs.
+//
+//   modules       [{ key, dir, manifest }] — the loader's `discovered().loaded` shape
+//   exists        (path, kind) => boolean — defaults to the real filesystem
+//   registryKeys  Set of valid `disciplines` entries, or null to skip that seam
+//
+// Returns { ok, findings[], wired[], declarative[] }. `wired` and `declarative` are
+// populated on the SUCCESS path too, deliberately: a guard that reports nothing when
+// it passes leaves no evidence it ran, so the caller prints the counts either way.
+function scanSeamWiring(modules = [], { exists = fsExists, registryKeys = null } = {}) {
+  const findings = [];
+  const wired = [];
+  const declarative = [];
+
+  for (const { key, dir, manifest } of modules) {
+    const contributes = (manifest && manifest.contributes) || {};
+    const exempt = (manifest && manifest.declarativeSeams) || {};
+    const isExempt = (seam, label) => Array.isArray(exempt[seam]) && exempt[seam].includes(label);
+
+    for (const [seam, value] of Object.entries(contributes)) {
+      const spec = SEAM_CONSUMERS[seam];
+      if (!spec) continue; // an unknown seam key is validateManifest's error, not ours
+
+      for (const entry of declaredEntries(seam, value)) {
+        const label = entryLabel(seam, entry);
+
+        if (spec.consumer === null) {
+          findings.push(`module "${key}" declares contributes.${seam}: "${label}", but NOTHING in the tree consumes the ${seam} seam at all — the declaration does nothing`);
+          continue;
+        }
+
+        // A 'registry' seam is satisfied by membership in a roster, not by a file.
+        if (spec.kind === 'registry') {
+          if (registryKeys && !registryKeys.has(label)) {
+            findings.push(`module "${key}" declares contributes.${seam}: "${label}", but ${spec.consumer} has no such entry`);
+          } else {
+            wired.push({ key, seam, entry: label, via: spec.consumer });
+          }
+          continue;
+        }
+
+        const primary = spec.artifact(dir, entry);
+        const candidates = [primary, ...(spec.alternates ? spec.alternates(dir, entry) : [])].filter(Boolean);
+        // An entry carrying path separators or '..' would aim the probe outside
+        // modules/<key>/. It is only an existence test over repo-committed content, so
+        // the blast radius is an on/off answer — but a declaration that reaches out of
+        // its own module is a finding in its own right, not something to resolve.
+        const escapes = candidates.find((p) => !within(dir, p));
+        if (escapes) {
+          findings.push(`module "${key}" declares contributes.${seam}: "${label}", which resolves to ${rel(escapes)} — outside the module's own directory. A contributes entry names something the module ships, so it may not contain a path separator or ".."`);
+          continue;
+        }
+        const found = candidates.some((p) => exists(p, spec.kind));
+
+        if (found) {
+          // A STALE exemption is the same rot in the other direction: the artifact
+          // exists now, so the entry IS wired and the exemption reads as though a
+          // real gap were sanctioned. Fail it rather than let the list quietly lie.
+          if (isExempt(seam, label)) {
+            findings.push(`module "${key}" exempts ${seam} "${label}" as declarative-only, but ${rel(primary)} exists and ${spec.consumer} wires it — drop the stale declarativeSeams.${seam} entry`);
+          } else {
+            wired.push({ key, seam, entry: label, via: spec.consumer });
+          }
+          continue;
+        }
+
+        if (isExempt(seam, label)) {
+          declarative.push({ key, seam, entry: label });
+          continue;
+        }
+
+        findings.push(`module "${key}" declares contributes.${seam}: "${label}", but ${rel(primary)} does not exist — ${spec.consumer} silently skips it. Ship the artifact, drop the declaration, or record it in declarativeSeams.${seam} if it is declarative-only on purpose`);
+      }
+    }
+  }
+
+  return { ok: findings.length === 0, findings, wired, declarative };
+}
+
+// The roster `contributes.disciplines` is checked against. Returns null when the file
+// is unreadable, which makes the disciplines seam UNCHECKED rather than failed — a
+// missing registry is its own check's problem (fitness.js role packs), not this one's.
+function disciplineKeys() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'discipline-modes.json'), 'utf8'));
+    return new Set(Object.keys(raw.modes || {}));
+  } catch {
+    return null;
+  }
+}
+
+// The fitness-check wrapper. Discovers every module.json through the loader — the same
+// discovery the running server uses, so the guard cannot check a different module set
+// than the one that boots.
+function checkSeamWiring() {
+  const name = 'declared module seams are consumed (task 1003819)';
+  let modules = [];
+  try {
+    modules = require('../../src/module-loader/loader.js').discoverModules().loaded;
+  } catch (e) {
+    return {
+      name,
+      ok: true,
+      hardFail: false,
+      violations: [],
+      warnings: [`module discovery failed: ${e && e.message ? e.message : e}`],
+      note: 'module discovery unavailable — skipped.',
+    };
+  }
+
+  const { ok, findings, wired, declarative } = scanSeamWiring(modules, { registryKeys: disciplineKeys() });
+  const seams = [...new Set(wired.map((w) => w.seam))].sort();
+  return {
+    name,
+    ok,
+    hardFail: !ok,
+    violations: findings,
+    warnings: [],
+    // Printed on the PASS path too — the wired set is the evidence the guard ran.
+    note: `${modules.length} module(s): ${wired.length} declared seam entr(ies) WIRED across ${seams.length} seam(s) (${seams.join(', ') || 'none'}), ${declarative.length} recorded declarative-only. A declared contributes.<seam> whose consumer's artifact is absent is a silent no-op (ADR 0289).`,
+  };
+}
+
+module.exports = { checkSeamWiring, scanSeamWiring, SEAM_CONSUMERS, declaredEntries, entryLabel, disciplineKeys };

package/scripts/gds/ship-finish.js

@@ -10,7 +10,7 @@
 
 const fs = require('node:fs');
 const os = require('node:os');
-const { cliClient, printOnboardingNudge, rewardPolicy } = require('./cli-lib');
+const { cliClient, printOnboardingNudge, rewardPolicy, cardFlagsFromMe } = require('./cli-lib');
 const { closeoutPlan } = require('../../modules/lifecycle/ship-preflight');
 const { syncMemoryOnShip } = require('./ship-memory-sync.js');
 const { uploadSessionOnShip } = require('./ship-session-upload.js');
@@ -264,17 +264,18 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
       commit = (v && v.commit) ? String(v.commit).slice(0, 7) : (gitOk('git rev-parse --short HEAD') || null);
     }
 
-    // Running drachmae total + the builder's render-widgets knob (task 1279),
-    // both from one /me fetch (best-effort).
+    // Running drachmae total + the builder's card-richness level (task 1279's
+    // knob, a ladder since task 1002518), both from one /me fetch (best-effort).
     let total = null;
-    let widgetsEnabled = true;
+    let cardFlags = cardFlagsFromMe(null);
     try {
       const me = noteServerReward(await (await cliClient()).me.getMe());
       if (me.ok && me.data) {
         if (me.data.builder) total = me.data.builder.total_credits;
-        if (me.data.render) widgetsEnabled = me.data.render.widgets_enabled !== false;
+        cardFlags = cardFlagsFromMe(me);
       }
-    } catch (_) { /* total + knob are optional; default widgets on */ }
+    } catch (_) { /* total + knob are optional; default to the standard rung */ }
+    const widgetsEnabled = cardFlags.showWidget;
 
     // Token count + estimated cost from the session usage. Split the tokens into
     // 'new' (fresh input + output + first-time cache writes) vs 'cached' re-reads
@@ -328,9 +329,12 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
     // Print the monospace card + write the branded HTML for the in-feed renderer
     // (shared emitCard, task 1275). The skill reads the printed path and passes
     // the contents to the visualization tool — the agent authors nothing, so the
-    // card is identical every ship. task 1279: when the builder has widgets off,
-    // emitCard prints only the monospace card (no HTML written or relayed).
-    shipCard.emitCard(model, taskId, { widgetsEnabled });
+    // card is identical every ship. task 1002518: the resolved richness level
+    // reaches emitCard as flags — at the plain rung no HTML is written or
+    // relayed, at the minimal rung not even the monospace card is printed (the
+    // guaranteed [otb-confirm] line always is), and at the rich rung the
+    // widget's summary arrives already open.
+    shipCard.emitCard(model, taskId, { flags: cardFlags });
 
     // task 1687: in CI deploy mode this card is 'confirmed — landing' and the real
     // confirmed->shipped land happens minutes later, server-side — so the SHIPPED
@@ -338,7 +342,10 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
     // land-watch hook renders the shipped card on a later prompt once it lands.
     // Best-effort: a breadcrumb must never fail a ship (mirrors the card itself).
     if (postGradeStatus === 'confirmed') {
-      try { require('./land-watch').writeBreadcrumb(taskId, { widgetsEnabled, cardInputs }); }
+      // `cardFlags` carries the resolved rung so the later-rendered shipped card
+      // matches the one this session printed; `widgetsEnabled` stays beside it
+      // so a breadcrumb written by an older CLI still reads correctly.
+      try { require('./land-watch').writeBreadcrumb(taskId, { widgetsEnabled, cardFlags, cardInputs }); }
       catch (_) { /* breadcrumb is best-effort */ }
     }
   } catch (_) {

package/scripts/gds/ship-flow.js

@@ -8,7 +8,7 @@
 
 'use strict';
 
-const { cliClient, requireSession, arg, detectWorktreeName } = require('./cli-lib');
+const { cliClient, requireSession, arg, detectWorktreeName, cardFlagsFromMe } = require('./cli-lib');
 const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
 const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
@@ -342,10 +342,10 @@ async function shipMain() {
           removed,
           sandboxUrl: sandboxGate.url,
         });
-        // task 1279: honour the builder's render-widgets knob (from the /me
-        // fetched at the top of shipMain; default ON if absent/older server).
-        const widgetsEnabled = me?.data?.render?.widgets_enabled !== false;
-        shipCard.emitCard(model, taskId, { widgetsEnabled });
+        // task 1279 / 1002518: honour the builder's card-richness level (from the
+        // /me fetched at the top of shipMain; the standard rung if absent, and
+        // the boolean's old meaning against an older server).
+        shipCard.emitCard(model, taskId, { flags: cardFlagsFromMe(me) });
       } catch (_) { /* the review pause stands with or without the card */ }
       // #1061 polish: a sandbox review pause is a DELIBERATE, expected
       // checkpoint — not a failed ship. printReviewBlock already showed the URL

package/scripts/gds/start.js

@@ -67,7 +67,7 @@ const { checkTree: _checkTree } = require('./tree-preflight.js');
   if (_fault) { console.error(_fault); process.exit(1); }
 }
 
-const { cliClient, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError } = require('./cli-lib');
+const { cliClient, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError, cardFlagsFromMe } = require('./cli-lib');
 const { contextPack, formatContextPackCompact } = require('./context-pack');
 const { depsFinding } = require('./preflight');
 
@@ -782,12 +782,18 @@ async function main() {
   }
 
   // ---------- widget (HTML for the app renderer) ----------
-  // task 1279: the per-builder "render widgets" knob. When a builder turns
-  // widgets off, even an explicit --widget request degrades to the markdown card
-  // below — so no HTML is emitted, read, or re-relayed (a real token saving, not
-  // just a visual change). Default ON; /me carries the resolved boolean. Headless
-  // /cron callers don't pass --widget at all (no renderer), so they're unaffected.
-  const widgetsPref = me.ok ? (me.data?.render?.widgets_enabled !== false) : true;
+  // task 1279 / 1002518: the per-builder card-richness level. Below the widget
+  // rung, even an explicit --widget request degrades to the markdown card below
+  // — so no HTML is emitted, read, or re-relayed (a real token saving, not just
+  // a visual change). /me carries the resolved level; an older instance carries
+  // only the boolean and cardFlagsFromMe reads either. Headless/cron callers
+  // don't pass --widget at all (no renderer), so they're unaffected.
+  //
+  // The `minimal` rung lands on the markdown card here rather than on nothing:
+  // the lifecycle card has a guaranteed one-line confirmation to fall back to,
+  // and this card — the list of what you can claim — has no such floor. Dropping
+  // it would leave a session opening with no answer to the question it asked.
+  const widgetsPref = me.ok ? cardFlagsFromMe(me).showWidget : true;
   if (widget && widgetsPref) {
     const myClaims = me.ok ? (me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : [])) : [];
     // Private warnings (budget / onboarding next-stage) → stderr, so stdout

package/src/bongos/auth-admission.js

@@ -46,12 +46,13 @@ function membershipKind({ githubLogin } = {}) {
 // Best-effort server-to-server membership check-in to the hub (ADR 0141 §3): "this
 // github_id builds on project <client_id>, coarse membership <membership_kind>".
 //
-// BOTH SPELLINGS GO ON THE WIRE FOR THE WINDOW (task 1003090). The receiver is the
-// HUB, a different instance on its own upgrade schedule: send only the new field and
-// an un-upgraded hub silently defaults every membership to non-owner (it would drop
-// the owner flag); send only the legacy field and an upgraded hub keeps translating
-// forever. Sending both is what makes the two ends independent — the removal task
-// drops `role` once the hub is past the window. Runs on every
+// ONE SPELLING ON THE WIRE: `membership_kind` (task 1003090 renamed it; task 1003092
+// closed the cross-version window). During the window this sender wrote BOTH
+// spellings, because the receiver is the HUB — a different instance on its own
+// upgrade schedule — and new-field-only against an un-upgraded hub would have
+// silently dropped the owner flag. The hub has been past that release since core
+// 1.19.241 and no longer accepts the legacy field (its schema is strict), so
+// sending it again would turn every check-in into a 400. Runs on every
 // FEDERATED sign-in (the only sign-ins a federated instance has) so a CLI-only
 // project still appears in the builder's My Projects with no hub browser session.
 // Fire-and-forget + fully swallowed: a hub outage must NEVER fail a sign-in (mirrors
@@ -72,8 +73,6 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
         display_name: displayName ?? null,
         avatar_url: avatarUrl ?? null,
         membership_kind: kind,
-        // LEGACY (cross-version window): 'member' → 'builder' for an un-upgraded hub.
-        role: kind === 'member' ? 'builder' : kind,
       }),
     });
   } catch (err) {

package/src/bongos/auth-config.js

@@ -135,8 +135,9 @@ function idpConfigured() {
 //
 // 'member', not 'builder' (task 1003090, ADR 0177 §"the fifth use"): ADR 0174 reserves
 // `role` — and the craft name 'Builder' — for Artist / Ideator / Builder, so the coarse
-// project membership says what it means. The legacy spelling still goes on the wire for
-// the cross-version window; see reportMembershipCheckIn.
+// project membership says what it means. It is the only spelling on the wire — the
+// cross-version window that carried the legacy one closed under task 1003092; see
+// reportMembershipCheckIn.
 
 module.exports = {
   SCOPE,

package/src/bongos/goal-scope-check.js

@@ -11,8 +11,11 @@
 //
 //   1. SCOPE-SUBSET — every `touches[]` element must be CONTAINED WITHIN the
 //      goal's territory (the union of its modules' globs, resolved via
-//      module-scope-map G01). This bounds *everyone*, regardless of rank: a goal
-//      member can only author work inside the goal's modules.
+//      module-scope-map G01) or in SHARED_GLOBS, the small set of roots no module
+//      can honestly own that every task legitimately writes (`tests/` — see the
+//      SHARED territory block in module-scope-map.js, task 1003655 / ADR 0288).
+//      This bounds *everyone*, regardless of rank: a goal member can only author
+//      work inside the goal's modules, plus that shared floor.
 //
 //   2. PROTECTED-PATH — a sub-Metic member (xenos/thetes) may not author a task
 //      touching the permission/ship-grade/deploy/migration core, even when that
@@ -37,7 +40,7 @@
 'use strict';
 
 const { matchOne } = require('./path-match');
-const { globsForModules } = require('./module-scope-map');
+const { globsForModules, SHARED_GLOBS } = require('./module-scope-map');
 const { checkPermissionPaths } = require('./permission-path-check');
 
 function clean(arr) {
@@ -54,13 +57,25 @@ function isCovered(touch, goalGlobs) {
   return matchOne(touch, goalGlobs || []) !== null;
 }
 
-// Wall 1 — scope subset. Pure: { ok, out_of_scope[], goal_globs[] }.
-// `ok` is true iff every cleaned touch is covered by the goal's resolved globs.
-// An empty/unknown module set resolves to zero globs → nothing is covered.
+// Wall 1 — scope subset. Pure: { ok, out_of_scope[], goal_globs[], shared_globs[] }.
+// `ok` is true iff every cleaned touch is covered by the goal's resolved globs OR
+// by the shared floor. An empty/unknown module set resolves to zero goal globs.
+//
+// `goal_globs` stays the MODULE-resolved set only — the shared floor is reported
+// separately and never folded in. check()'s unknown_scope guard tests
+// `goal_globs.length === 0`, so mixing the always-present shared globs into it
+// would make a goal scoped to nothing but garbage resolve to a non-empty
+// territory and slip past that fail-closed edge.
 function scopeSubset(goalScopeModules, touches) {
   const goalGlobs = globsForModules(clean(goalScopeModules));
-  const outOfScope = clean(touches).filter((p) => !isCovered(p, goalGlobs));
-  return { ok: outOfScope.length === 0, out_of_scope: outOfScope, goal_globs: goalGlobs };
+  const outOfScope = clean(touches)
+    .filter((p) => !isCovered(p, goalGlobs) && !isCovered(p, SHARED_GLOBS));
+  return {
+    ok: outOfScope.length === 0,
+    out_of_scope: outOfScope,
+    goal_globs: goalGlobs,
+    shared_globs: [...SHARED_GLOBS],
+  };
 }
 
 // Wall 2 — the protected-path delegate. Thin wrapper over checkPermissionPaths

package/src/bongos/module-scope-map.js

@@ -388,6 +388,44 @@ const MODULE_GLOBS = {
   ],
 };
 
+// ---------------------------------------------------------------------------
+// SHARED territory — the globs EVERY goal's wall implicitly includes (task 1003655).
+//
+// MODULE_GLOBS answers "who OWNS this path". Some paths have no honest owner: a
+// shared root that every module writes into and none ships. `tests/` is the one
+// that mattered — 751 flat suites covering all ~24 modules, owned by no key — so
+// scopeSubset() denied EVERY touch under it. Since every real task adds a test,
+// the create gate (POST /goals/:id/tasks) refused any task that honestly declared
+// its own test file, whichever goal it was filed under. The wall only looked
+// passable because callers under-declared their touches[] (idea 1000816).
+//
+// The two fixes we did NOT take, and why:
+//   • Give `tests/` to a key (devsecops, methodology). That is a FALSE ownership
+//     claim — an ideas-module test is the ideas module's work, not devsecops' —
+//     and it would hand one goal's members the whole suite while denying it to
+//     everyone else, which is worse than the gap.
+//   • Enumerate per-module test paths. The suites are flat and named by feature,
+//     not by module, and the glob format has no wildcards to carve with; the list
+//     would rot on the next test file.
+//
+// So `tests/` is SHARED, not owned: inside every goal's wall, outside every
+// module's territory. That is sound because a test file is not a shipping
+// surface — nothing imports it, so its blast radius on another module is zero —
+// and the other two walls are untouched: claim collisions are still caught by
+// touchesOverlap, and the protected-path wall (below) runs independently.
+//
+// FAIL-CLOSED, like `protected`: the exported list is DERIVED, not trusted. A
+// shared glob is dropped if it overlaps PROTECTED_GLOBS, because a protected path
+// in here would widen every goal's wall into the trust core in one line. Adding
+// an entry is a deliberate design decision (ADR 0288) — the bar is "no module can
+// honestly own it AND every task legitimately writes it", which today is `tests/`
+// alone. Module-owned suites (modules/<key>/tests/) are already covered by their
+// module's glob and do NOT belong here.
+const SHARED_GLOBS_RAW = ['tests/'];
+const SHARED_GLOBS = Object.freeze(
+  SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
+);
+
 // A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one
 // source of truth (permission-path-check.js). Prefix-aware both directions
 // (path-match.touchesOverlap), so e.g. a module owning 'src/bongos/routes/inbox.js'
@@ -451,6 +489,8 @@ function scopeIncludesProtected(keys) {
 module.exports = {
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
+  SHARED_GLOBS,
+  SHARED_GLOBS_RAW,
   isProtected,
   moduleKeys,
   isModuleKey,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.773'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.775'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');